SC-401 Practice Question 3627
Exam: SC-401
Domain: Manage risks, alerts, and activities
Difficulty: easy
You need to search the Microsoft Purview Unified Audit Log for all file deletion events executed across SharePoint Online during the past 48 hours. Which PowerShell cmdlet executes this query?
Answer Options
A
Search-UnifiedAuditLog
B
Get-MailboxStatistics
C
Test-EmailFlowOrientation
D
Set-ExecutionPolicy
Correct Answer
A: Search-UnifiedAuditLog
Explanation
The `Search-UnifiedAuditLog` cmdlet queries the unified audit log using parameters like `-Operations FileDeleted`, `-StartDate`, `-EndDate`, and `-RecordType SharePoint`.